236 lines
7.7 KiB
Bash
Executable File
236 lines
7.7 KiB
Bash
Executable File
# $OpenBSD: forward-control.sh,v 1.7 2018/06/07 14:29:43 djm Exp $
|
|
# Placed in the Public Domain.
|
|
|
|
tid="sshd control of local and remote forwarding"
|
|
|
|
LFWD_PORT=3320
|
|
RFWD_PORT=3321
|
|
CTL=$OBJ/ctl-sock
|
|
READY=$OBJ/ready
|
|
|
|
wait_for_file_to_appear() {
|
|
_path=$1
|
|
_n=0
|
|
while test ! -f $_path ; do
|
|
test $_n -eq 1 && trace "waiting for $_path to appear"
|
|
_n=`expr $_n + 1`
|
|
test $_n -ge 20 && return 1
|
|
sleep 1
|
|
done
|
|
return 0
|
|
}
|
|
|
|
wait_for_process_to_exit() {
|
|
_pid=$1
|
|
_n=0
|
|
while kill -0 $_pid 2>/dev/null ; do
|
|
test $_n -eq 1 && trace "waiting for $_pid to exit"
|
|
_n=`expr $_n + 1`
|
|
test $_n -ge 20 && return 1
|
|
sleep 1
|
|
done
|
|
return 0
|
|
}
|
|
|
|
# usage: check_lfwd Y|N message
|
|
check_lfwd() {
|
|
_expected=$1
|
|
_message=$2
|
|
rm -f $READY
|
|
${SSH} -F $OBJ/ssh_proxy \
|
|
-L$LFWD_PORT:127.0.0.1:$PORT \
|
|
-o ExitOnForwardFailure=yes \
|
|
-n host exec sh -c \'"sleep 60 & echo \$! > $READY ; wait "\' \
|
|
>/dev/null 2>&1 &
|
|
_sshpid=$!
|
|
wait_for_file_to_appear $READY || \
|
|
fatal "check_lfwd ssh fail: $_message"
|
|
${SSH} -F $OBJ/ssh_config -p $LFWD_PORT \
|
|
-oConnectionAttempts=4 host true >/dev/null 2>&1
|
|
_result=$?
|
|
kill $_sshpid `cat $READY` 2>/dev/null
|
|
wait_for_process_to_exit $_sshpid
|
|
if test "x$_expected" = "xY" -a $_result -ne 0 ; then
|
|
fail "check_lfwd failed (expecting success): $_message"
|
|
elif test "x$_expected" = "xN" -a $_result -eq 0 ; then
|
|
fail "check_lfwd succeeded (expecting failure): $_message"
|
|
elif test "x$_expected" != "xY" -a "x$_expected" != "xN" ; then
|
|
fatal "check_lfwd invalid argument \"$_expected\""
|
|
else
|
|
verbose "check_lfwd done (expecting $_expected): $_message"
|
|
fi
|
|
}
|
|
|
|
# usage: check_rfwd Y|N message
|
|
check_rfwd() {
|
|
_expected=$1
|
|
_message=$2
|
|
rm -f $READY
|
|
${SSH} -F $OBJ/ssh_proxy \
|
|
-R127.0.0.1:$RFWD_PORT:127.0.0.1:$PORT \
|
|
-o ExitOnForwardFailure=yes \
|
|
-n host exec sh -c \'"sleep 60 & echo \$! > $READY ; wait "\' \
|
|
>/dev/null 2>&1 &
|
|
_sshpid=$!
|
|
wait_for_file_to_appear $READY
|
|
_result=$?
|
|
if test $_result -eq 0 ; then
|
|
${SSH} -F $OBJ/ssh_config -p $RFWD_PORT \
|
|
-oConnectionAttempts=4 host true >/dev/null 2>&1
|
|
_result=$?
|
|
kill $_sshpid `cat $READY` 2>/dev/null
|
|
wait_for_process_to_exit $_sshpid
|
|
fi
|
|
if test "x$_expected" = "xY" -a $_result -ne 0 ; then
|
|
fail "check_rfwd failed (expecting success): $_message"
|
|
elif test "x$_expected" = "xN" -a $_result -eq 0 ; then
|
|
fail "check_rfwd succeeded (expecting failure): $_message"
|
|
elif test "x$_expected" != "xY" -a "x$_expected" != "xN" ; then
|
|
fatal "check_rfwd invalid argument \"$_expected\""
|
|
else
|
|
verbose "check_rfwd done (expecting $_expected): $_message"
|
|
fi
|
|
}
|
|
|
|
start_sshd
|
|
cp ${OBJ}/sshd_proxy ${OBJ}/sshd_proxy.bak
|
|
cp ${OBJ}/authorized_keys_${USER} ${OBJ}/authorized_keys_${USER}.bak
|
|
|
|
# Sanity check: ensure the default config allows forwarding
|
|
check_lfwd Y "default configuration"
|
|
check_rfwd Y "default configuration"
|
|
|
|
# Usage: lperm_tests yes|local|remote|no Y|N Y|N Y|N Y|N Y|N Y|N
|
|
lperm_tests() {
|
|
_tcpfwd=$1
|
|
_plain_lfwd=$2
|
|
_plain_rfwd=$3
|
|
_nopermit_lfwd=$4
|
|
_nopermit_rfwd=$5
|
|
_permit_lfwd=$6
|
|
_permit_rfwd=$7
|
|
_badfwd1=127.0.0.1:22
|
|
_badfwd2=127.0.0.2:22
|
|
_goodfwd=127.0.0.1:${PORT}
|
|
cp ${OBJ}/authorized_keys_${USER}.bak ${OBJ}/authorized_keys_${USER}
|
|
_prefix="AllowTcpForwarding=$_tcpfwd"
|
|
|
|
# No PermitOpen
|
|
( cat ${OBJ}/sshd_proxy.bak ;
|
|
echo "AllowTcpForwarding $_tcpfwd" ) \
|
|
> ${OBJ}/sshd_proxy
|
|
check_lfwd $_plain_lfwd "$_prefix"
|
|
check_rfwd $_plain_rfwd "$_prefix"
|
|
|
|
# PermitOpen via sshd_config that doesn't match
|
|
( cat ${OBJ}/sshd_proxy.bak ;
|
|
echo "AllowTcpForwarding $_tcpfwd" ;
|
|
echo "PermitOpen $_badfwd1 $_badfwd2" ) \
|
|
> ${OBJ}/sshd_proxy
|
|
check_lfwd $_nopermit_lfwd "$_prefix, !PermitOpen"
|
|
check_rfwd $_nopermit_rfwd "$_prefix, !PermitOpen"
|
|
# PermitOpen via sshd_config that does match
|
|
( cat ${OBJ}/sshd_proxy.bak ;
|
|
echo "AllowTcpForwarding $_tcpfwd" ;
|
|
echo "PermitOpen $_badfwd1 $_goodfwd $_badfwd2" ) \
|
|
> ${OBJ}/sshd_proxy
|
|
check_lfwd $_plain_lfwd "$_prefix, PermitOpen"
|
|
check_rfwd $_plain_rfwd "$_prefix, PermitOpen"
|
|
|
|
# permitopen keys option.
|
|
# NB. permitopen via authorized_keys should have same
|
|
# success/fail as via sshd_config
|
|
# permitopen via authorized_keys that doesn't match
|
|
sed "s/^/permitopen=\"$_badfwd1\",permitopen=\"$_badfwd2\" /" \
|
|
< ${OBJ}/authorized_keys_${USER}.bak \
|
|
> ${OBJ}/authorized_keys_${USER} || fatal "sed 1 fail"
|
|
( cat ${OBJ}/sshd_proxy.bak ;
|
|
echo "AllowTcpForwarding $_tcpfwd" ) \
|
|
> ${OBJ}/sshd_proxy
|
|
check_lfwd $_nopermit_lfwd "$_prefix, !permitopen"
|
|
check_rfwd $_nopermit_rfwd "$_prefix, !permitopen"
|
|
# permitopen via authorized_keys that does match
|
|
sed "s/^/permitopen=\"$_badfwd1\",permitopen=\"$_goodfwd\" /" \
|
|
< ${OBJ}/authorized_keys_${USER}.bak \
|
|
> ${OBJ}/authorized_keys_${USER} || fatal "sed 2 fail"
|
|
( cat ${OBJ}/sshd_proxy.bak ;
|
|
echo "AllowTcpForwarding $_tcpfwd" ) \
|
|
> ${OBJ}/sshd_proxy
|
|
check_lfwd $_permit_lfwd "$_prefix, permitopen"
|
|
check_rfwd $_permit_rfwd "$_prefix, permitopen"
|
|
|
|
# Check port-forwarding flags in authorized_keys.
|
|
# These two should refuse all.
|
|
sed "s/^/no-port-forwarding /" \
|
|
< ${OBJ}/authorized_keys_${USER}.bak \
|
|
> ${OBJ}/authorized_keys_${USER} || fatal "sed 3 fail"
|
|
( cat ${OBJ}/sshd_proxy.bak ;
|
|
echo "AllowTcpForwarding $_tcpfwd" ) \
|
|
> ${OBJ}/sshd_proxy
|
|
check_lfwd N "$_prefix, no-port-forwarding"
|
|
check_rfwd N "$_prefix, no-port-forwarding"
|
|
sed "s/^/restrict /" \
|
|
< ${OBJ}/authorized_keys_${USER}.bak \
|
|
> ${OBJ}/authorized_keys_${USER} || fatal "sed 4 fail"
|
|
( cat ${OBJ}/sshd_proxy.bak ;
|
|
echo "AllowTcpForwarding $_tcpfwd" ) \
|
|
> ${OBJ}/sshd_proxy
|
|
check_lfwd N "$_prefix, restrict"
|
|
check_rfwd N "$_prefix, restrict"
|
|
# This should pass the same cases as _nopermit*
|
|
sed "s/^/restrict,port-forwarding /" \
|
|
< ${OBJ}/authorized_keys_${USER}.bak \
|
|
> ${OBJ}/authorized_keys_${USER} || fatal "sed 5 fail"
|
|
( cat ${OBJ}/sshd_proxy.bak ;
|
|
echo "AllowTcpForwarding $_tcpfwd" ) \
|
|
> ${OBJ}/sshd_proxy
|
|
check_lfwd $_plain_lfwd "$_prefix, restrict,port-forwarding"
|
|
check_rfwd $_plain_rfwd "$_prefix, restrict,port-forwarding"
|
|
}
|
|
|
|
# permit-open none mismatch match
|
|
# AllowTcpForwarding local remote local remote local remote
|
|
lperm_tests yes Y Y N Y Y Y
|
|
lperm_tests local Y N N N Y N
|
|
lperm_tests remote N Y N Y N Y
|
|
lperm_tests no N N N N N N
|
|
|
|
# Usage: rperm_tests yes|local|remote|no Y|N Y|N Y|N Y|N Y|N Y|N
|
|
rperm_tests() {
|
|
_tcpfwd=$1
|
|
_plain_lfwd=$2
|
|
_plain_rfwd=$3
|
|
_nopermit_lfwd=$4
|
|
_nopermit_rfwd=$5
|
|
_permit_lfwd=$6
|
|
_permit_rfwd=$7
|
|
_badfwd1=127.0.0.1:22
|
|
_badfwd2=127.0.0.2:${RFWD_PORT}
|
|
_goodfwd=127.0.0.1:${RFWD_PORT}
|
|
cp ${OBJ}/authorized_keys_${USER}.bak ${OBJ}/authorized_keys_${USER}
|
|
_prefix="AllowTcpForwarding=$_tcpfwd"
|
|
|
|
# PermitListen via sshd_config that doesn't match
|
|
( cat ${OBJ}/sshd_proxy.bak ;
|
|
echo "AllowTcpForwarding $_tcpfwd" ;
|
|
echo "PermitListen $_badfwd1 $_badfwd2" ) \
|
|
> ${OBJ}/sshd_proxy
|
|
check_lfwd $_nopermit_lfwd "$_prefix, !PermitListen"
|
|
check_rfwd $_nopermit_rfwd "$_prefix, !PermitListen"
|
|
# PermitListen via sshd_config that does match
|
|
( cat ${OBJ}/sshd_proxy.bak ;
|
|
echo "AllowTcpForwarding $_tcpfwd" ;
|
|
echo "PermitListen $_badfwd1 $_goodfwd $_badfwd2" ) \
|
|
> ${OBJ}/sshd_proxy
|
|
check_lfwd $_plain_lfwd "$_prefix, PermitListen"
|
|
check_rfwd $_plain_rfwd "$_prefix, PermitListen"
|
|
}
|
|
|
|
# permit-remote-open none mismatch match
|
|
# AllowTcpForwarding local remote local remote local remote
|
|
rperm_tests yes Y Y Y N Y Y
|
|
rperm_tests local Y N Y N Y N
|
|
rperm_tests remote N Y N N N Y
|
|
rperm_tests no N N N N N N
|
|
|